11.4.1 syscall Probes

syscall provides a pair of probes for each
system call: an entry probe that fires before
the system call is entered, and a return
probe that fires after the system call has completed, but before
control has been transferred back to user-level. For all
syscall probes, the function name is set as
the name of the instrumented system call.

Often, the system call names that are provided by
syscall correspond to names in the Section 2
manual pages. However, some syscall provider
probes do not directly correspond to any documented system call.
Some common reasons for this discrepancy are described in the
following sections.